Security bit position FlashMagic is using differs from Datasheet

[Mucter]

Hello everyone.
I monitered the communication between Flash Magic and my Target board's P89V51RC2FN while I did Read Security bit Command.
before this, I checked "Set Security Bit 1" , "Prog Clocks Bit" option and click Start Button.

Flash Magic sended: :020000050700F2
Target replied: :020000050700F219.[CR][LF]

but in its Datasheet [6.3.4 Using the ISP] [Table 12. ISP hex record formats] [Record type 05]
says.
------------------------------------
05 Miscellaneous Read Functions
:02xxxx05ffsscc
Where:
02 = number of bytes in the record
xxxx = required field but value is a 'don't care'
05 = function code for misc read
ffss = subfunction and selection code
0000 = read manufacturer id
0001 = read device id 1
0002 = read bootcode version
0700 = read security bit (00 SoftICE serial number match 0 SB 0 Double Clock)
cc = checksum
Example:
:020000050000F9 (display manufacturer id)
----------------------------------------------
Datesheet's SB 's position is bit2. but the monitering data indicates SB 's position is bit3.

Additionally,
Target programed by parallel Programmer with SB on replys : :020000050700F215.[CR][LF]
It met with datasheet,but Flashmagic says Security bit unset!

Moreover,
a P89V51RC2FN programmed by Flash Magic SB on were data readable by parallel programmer!
What a Security Flash Magic is.

Mucter,

[Mucter]

Let's me comment.

When Set Security Bit 1 is checked , Flash Magic sends
":020000030500F6"
But in Datasheet Table 12. ISP hex record formats
---------------------
03 Miscellaneous Write Functions
:nnxxxx03ffssddcc
Where:
nn = number of bytes in the record
xxxx = required field but value is a 'don't care'
ff = subfunction code
ss = selection code
dd = data (if needed)
cc = checksum
Subfunction code = 01 (Erase block 0)
ff = 01
Subfunction code = 05 (Program security bit, Double Clock)
ff = 05
ss = 01 program security bit
ss = 05 program double clock bit
Subfunction code = 08 (Erase sector, 128 B)
ff = 08
ss = high byte of sector address (A15:
dd = low byte of sector address (A7, A6:0 = 0)
Example:
:0300000308E000F2 (erase sector at E000H)
-------------------------------------
There are not ss = 00 imformation.

From my experiment,
ss = 00 causes Rectype 07's output's bit3 0 to 1 => flash Magic uses this command by mistake?.
ss = 01 causes Rectype 07's output's bit2 0 to 1 => mentioned by datasheet
ss = 02 causes Rectype 07's output's bit1 0 to 1
ss = 03,04 no change
ss = 04 causes Rectype 07's output's bit0 0 to 1 => mentioned by datasheet

Mucter,

[Andy Ayre]

I'll look into this on Friday or early next week.

Andy

[Andy Ayre]

Please give version 5.37 a try.

Andy

[Mucter]

Hi Andy.

The Flash Magic 5.37.1794 works fine.

set command:
:020000030501F5.

view command:
:020000050700F214.

Mucter.

[kittiplu]

I've been use Flash Magic Version 5.61.1870 for setting security bit P89V51RD2FN, it cannot set security.
Please let me know how can I do or which version support.

Otherwise I had set a security bit on a parallel programmer(All-100 from hilo systems), but
it can read all of content in flash memory from flash magic software.

Best Regards,
Kitti.

[Andy Ayre]

Please read the NXP user manual for your device. It says:

"When the Security Bit is activated all parallel programming commands except for Chip-Erase are ignored (thus the device cannot be read). However, ISP reading, writing, or erasing of the user's code can still be performed"

There is a lot of useful information in the NXP user manuals...

Andy

[kittiplu]

Thank you for your valuable information.
Kitti.